{ "@id": "urn:uuid:6cb7cec4-88b7-42b8-a16c-d1a1ca842541", "role": "Document Creator", "author": "https://tuxcare.com", "version": 1, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-09-24T09:31:26.931840+00:00", "statements": [ { "status": "fixed", "products": [ { "@id": "pkg:npm/tar@6.2.1-tuxcare.5", "identifiers": { "purl": "pkg:npm/tar@6.2.1-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-23745 is fixed in version 6.2.1-tuxcare.5 of tar.", "vulnerability": { "name": "CVE-2026-23745" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/tar@6.2.1-tuxcare.5", "identifiers": { "purl": "pkg:npm/tar@6.2.1-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-23950 is fixed in version 6.2.1-tuxcare.5 of tar.", "vulnerability": { "name": "CVE-2026-23950" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/tar@6.2.1-tuxcare.5", "identifiers": { "purl": "pkg:npm/tar@6.2.1-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24842 is fixed in version 6.2.1-tuxcare.5 of tar.", "vulnerability": { "name": "CVE-2026-24842" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/tar@6.2.1-tuxcare.5", "identifiers": { "purl": "pkg:npm/tar@6.2.1-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26960 is fixed in version 6.2.1-tuxcare.5 of tar.", "vulnerability": { "name": "CVE-2026-26960" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/tar@6.2.1-tuxcare.5", "identifiers": { "purl": "pkg:npm/tar@6.2.1-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29786 is fixed in version 6.2.1-tuxcare.5 of tar.", "vulnerability": { "name": "CVE-2026-29786" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/tar@6.2.1-tuxcare.5", "identifiers": { "purl": "pkg:npm/tar@6.2.1-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31802 is fixed in version 6.2.1-tuxcare.5 of tar.", "vulnerability": { "name": "CVE-2026-31802" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/tar@6.2.1-tuxcare.5", "identifiers": { "purl": "pkg:npm/tar@6.2.1-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53655 is fixed in version 6.2.1-tuxcare.5 of tar.", "vulnerability": { "name": "CVE-2026-53655" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/tar@6.2.1-tuxcare.5", "identifiers": { "purl": "pkg:npm/tar@6.2.1-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59871 is fixed in version 6.2.1-tuxcare.5 of tar.", "vulnerability": { "name": "CVE-2026-59871" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/tar@6.2.1-tuxcare.5", "identifiers": { "purl": "pkg:npm/tar@6.2.1-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59873 is fixed in version 6.2.1-tuxcare.5 of tar.", "vulnerability": { "name": "CVE-2026-59873" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/tar@6.2.1-tuxcare.5", "identifiers": { "purl": "pkg:npm/tar@6.2.1-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59874 is fixed in version 6.2.1-tuxcare.5 of tar.", "vulnerability": { "name": "CVE-2026-59874" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/tar@6.2.1-tuxcare.5", "identifiers": { "purl": "pkg:npm/tar@6.2.1-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59875 is fixed in version 6.2.1-tuxcare.5 of tar.", "vulnerability": { "name": "CVE-2026-59875" } }, { "status": "affected", "products": [ { "@id": "pkg:npm/tar@6.2.1-tuxcare.5", "identifiers": { "purl": "pkg:npm/tar@6.2.1-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-73566 affects version 6.2.1-tuxcare.5 of tar.", "vulnerability": { "name": "CVE-2026-73566" }, "action_statement": "Vulnerability CVE-2026-73566 affects version 6.2.1-tuxcare.5 of tar." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/tar@6.2.1-tuxcare.5", "identifiers": { "purl": "pkg:npm/tar@6.2.1-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qffp-2rhf-9h96 does not affect version 6.2.1-tuxcare.5 of tar. already_fixed \u2014 The target repository (tar 6.2.1-tuxcare.3) already contains a backport of the vendor fix for GHSA-qffp-2rhf-9h96. The fix was applied in commit 4b41989e on March 13, 2026, which backported CVE-2026-29786 (the CVE identifier corresponding to GHSA-qffp-2rhf-9h96). The defense strips drive-relative root prefixes (like 'C:') from paths BEFORE checking for parent directory traversal sequences ('..').", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qffp-2rhf-9h96" }, "impact_statement": "already_fixed \u2014 The target repository (tar 6.2.1-tuxcare.3) already contains a backport of the vendor fix for GHSA-qffp-2rhf-9h96. The fix was applied in commit 4b41989e on March 13, 2026, which backported CVE-2026-29786 (the CVE identifier corresponding to GHSA-qffp-2rhf-9h96). The defense strips drive-relative root prefixes (like 'C:') from paths BEFORE checking for parent directory traversal sequences ('..')." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/tar@6.2.1-tuxcare.5", "identifiers": { "purl": "pkg:npm/tar@6.2.1-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-r292-9mhp-454m is fixed in version 6.2.1-tuxcare.5 of tar.", "vulnerability": { "name": "GHSA-r292-9mhp-454m" } } ] }